Security and privacy
What awardlanes stores about you, who handles it for us, and how to have it deleted.
Checked against our code and our hosting accounts on Nov 8, 2026.
- We record how the site and app are used, including session replays.
- We don't sell your data or share your email with vendors, other brokers or USDA.
- Ask and we delete it: data@awardlanes.com
What we store
- You browse awardlanes.com
- The pages you view, your clicks and scrolling, the site that sent you and any campaign tags in the link, your browser and device, and your IP address (for rough location and to tell people from bots).
- You give us your email
- For a CSV download, the free trial, an offer or a campaign page: your email, the states you picked, what you downloaded and when, and where your first and latest visits came from.
- You have an account
- Your email and, if you give them, your name and your brokerage's name, MC or USDOT number and office state. Your states, the teammates you invite, and a copy of each email we send you.
- You report a wrong record or send feedback
- What you wrote, the lane and data date it refers to, your email if you give it, and a screenshot if you attach one.
- You book a call
- Your email and whatever you add: name, company, phone, time zone and a note.
- You pay, once billing is on
- Your Stripe customer ID and subscription status. Your card details stay with Stripe.
Where it runs
The site, the app and its database run in the US, in northern Virginia. Analytics and session replays are stored in the EU, in Frankfurt. Each region below is the one our account with that provider uses, checked on Nov 8, 2026.
- What
- This website, awardlanes.com
- Run by
- Fly.io
- Where
- Ashburn, Virginia (US) (source)
- What
- The app, app.awardlanes.com
- Run by
- Fly.io
- Where
- Ashburn, Virginia (US) (source)
- What
- The app's backend and database
- Accounts, saved states, email captures, reports, bookings and copies of the emails the app writes.
- Run by
- Convex, on Amazon Web Services (region aws-us-east-1)
- Where
- US East (N. Virginia) (source)
- What
- Files you upload
- Today that's only screenshots attached to feedback.
- Run by
- Convex file storage, in the same deployment
- Where
- US East (N. Virginia) (source)
- What
- Analytics and session replay (site and app)
- Run by
- PostHog Cloud EU
- Where
- Frankfurt (Germany) (source)
- What
- Email to you from updates.awardlanes.com: sign-in codes, the weekly feed, trial emails
- Run by
- Amazon SES, from updates.awardlanes.com
- What
- Sign-in codes we email you, until our own sender is switched on
- Run by
- Resend, from updates.heliosone.fi
- Where
- US East (N. Virginia) (source)
- What
- Our internal alerts to our own inbox
- Run by
- Resend, to Helios One Oy's Google Workspace inbox
- Where
- US East (N. Virginia) (source)
- What
- Payments
- Card details stay with Stripe.
- Run by
- Stripe (Helios One Oy's Stripe account)
- Where
- Region not confirmed
- Billing is not switched on yet.
- What
- Email you send to an @awardlanes.com address
- Run by
- Forward Email, which forwards it to Helios One Oy's Google Workspace inbox
- Where
- Region not confirmed
- What
- The weekly data run
- It reads USDA's public files. No customer data.
- Run by
- Fly.io
- Where
- Ashburn, Virginia (US) (source)
- What
- The data run's files
- Copies of USDA's public files and the weekly snapshots. No customer data.
- Run by
- Tigris object storage (private bucket)
- Where
- Global: Tigris distributes the data across its regions, not one fixed place (source)
How we record site use
We use PostHog for analytics, including session replay: a recording of what you see and do on a page (page changes, clicks, scrolling and typing). Replays help us find what's broken or confusing. Password fields and anything we mark as sensitive are masked. Other things you type into our forms, such as your email address, can appear in a replay.
PostHog's requests go through our own domain, and our server also records each page it serves, so a visit is counted even when the page's scripts don't run. Visits from bots and crawlers are recorded too, flagged so they aren't counted as people.
Cookies
All of these are first-party cookies on awardlanes.com. We run no advertising cookies.
-
al_gid - A random guest ID that ties your visits to the site and the app together.
- 400 days
-
al_ft - Where your first visit came from: campaign tags (utm_*), the referring site and the page you landed on.
- 400 days
-
al_lt - The same for your latest visit that came from a campaign link or another site.
- 400 days
-
al_rid - A recipient ID, when you arrive from a link in one of our emails.
- 400 days
-
al_states - The states you picked in a territory box or that came in a link (for example TX-OK), so the next page shows lanes for the same states and a trial you start keeps them as your territory.
- 400 days
-
al_exit - Whether you've already seen the one-time offer that appears when you seem about to leave, given us your email in it, or asked for a call, so we don't show it again. A copy is also kept in your browser's local storage.
- 400 days
-
al_bot - Set only when our server thinks the visitor is a bot, crawler or data-center client, so analytics can tell them apart.
- 30 days
-
ph_…_posthog - PostHog's own visitor and session ID.
- Set by PostHog
Who handles it for us
These companies process data for awardlanes. Each link goes to its own privacy policy.
-
Fly.io
Runs our web servers: awardlanes.com and the awardlanes app.
Servers: Ashburn, Virginia (US) (source)
-
Convex
The app's database and backend: accounts, saved states, email captures, reports, bookings, feedback screenshots and copies of the emails the app writes. Convex runs on Amazon Web Services and serves the app's API through Cloudflare's network.
Servers: Amazon Web Services, US East (N. Virginia) (source)
-
PostHog
Product analytics and session replay for the site and the app.
Servers: PostHog Cloud EU, Frankfurt (Germany) (source)
-
Resend
Sends our internal alerts to our own inbox (for example when someone books a call) and, until our own sender is switched on, the sign-in codes the app emails you, from updates.heliosone.fi (Helios One Oy's sending domain).
Servers: US East (N. Virginia), us-east-1 (source)
-
Amazon SES
Will send the email you get from the app: sign-in codes, the weekly feed and trial emails, from updates.awardlanes.com.
Not switched on yet.
Servers: US East (N. Virginia), us-east-1 (source)
-
Stripe
Billing. Card details go to Stripe's checkout page; we never see your full card number.
Billing is not switched on yet.
-
Forward Email
Receives email sent to our @awardlanes.com addresses and forwards it to our own inbox.
-
Google Workspace
Our own inbox (Helios One Oy's account). Our internal alerts and the email you send to an @awardlanes.com address land there.
How we protect it
- Encrypted connections only. awardlanes.com redirects plain HTTP to HTTPS and sends HSTS, so browsers refuse an unencrypted connection.
- No third-party scripts beyond PostHog. On awardlanes.com, a Content-Security-Policy header blocks other scripts and stops other sites from framing our pages.
- No passwords. You sign in to the app with a one-time code sent to your email, so there is no password to leak or reuse.
- Rate limits. Our public endpoints limit how many requests one address can make per minute.
You can check the first two yourself: both headers are on every page of awardlanes.com (your browser's developer tools, Network tab).
Public records about brokers and vendors
Lanes name food vendors exactly as USDA's award notices print them (USDA's procurement portal). When you type an MC or USDOT number, we look it up in our own copy of FMCSA's public broker files (data.transportation.gov); the number is not sent to FMCSA.
If a record about your company looks wrong, use “Wrong record?” on the lane or email us.
Delete your data or ask a question
Email data@awardlanes.com from the address you used with us, or write to Helios One Oy, 3075 Clay St, San Francisco, CA 94115. We confirm by email and, within 30 days, delete your account and what's linked to it: email captures, saved states, reports, bookings and our copies of emails we sent you. We also delete your person profile and replays in PostHog. We keep only what the law requires us to keep, such as invoices.
Every weekly feed email and trial email has an unsubscribe link.
Report a security problem
Email data@awardlanes.com with what you found and how to reproduce it. Please don't access other people's data or disrupt the service while you test.